Koloth Care Solutions Ltd — Staff Privacy Notice
Version 1.0 — Who we are: Koloth Care Solutions Ltd ("we", "us") is the data controller for the personal data of agency workers and applicants processed through this staffing portal.
1. What data we collect
Identity and contact details: name, email, phone number, address, date of birthRecruitment and engagement records: application forms, Terms of Engagement, Key Information Document, referencesRight to work evidence: passport, visa/share code and related identity documentsCriminal record data: DBS certificate details and DBS declarationsHealth-related data you provide for work purposes (e.g. fitness to work, vaccinations, training restrictions)Work records: shifts, assignments, timesheets, client signatures, training and compliance recordsPay data: pay rates, payroll reports, limited company invoicing detailsDigital signature records: your drawn signature, the date/time (UTC) and the IP address used when signingTechnical data: login activity and audit logs (user, action, time, IP address)2. Why we use it and our lawful basis
To perform our contract with you (Terms of Engagement): arranging shifts, assignments, timesheets and pay — UK GDPR Article 6(1)(b)To comply with legal obligations: right-to-work checks, HMRC payroll records, Agency Workers Regulations, Conduct Regulations — Article 6(1)(c)Legitimate interests: running and securing this portal, audit logging, service communications — Article 6(1)(f)Special category data (e.g. health): processed for employment-law purposes under Article 9(2)(b)Criminal record (DBS) data: processed under the Rehabilitation of Offenders Act 1974 (Exceptions) Order and Police Act 1997 for safeguarding in regulated care activity (DPA 2018 Schedule 1)We do not rely on consent for the processing needed to engage and pay you. Where we ask you to acknowledge this notice, that is a record of transparency, not consent.
3. Who receives your data (recipients and processors)
Client care providers where you are placed (name, role, compliance status only as necessary)Our IT processors: database hosting, secure object storage for documents, and application hosting (Emergent platform)Google LLC (Gmail API) when we email you documents or notificationsWhatsApp/Meta where you have provided a number and we send shift notifications. We do not send DBS, identity, right-to-work or health documents via WhatsApp — these are only available through the secure portal.HMRC, regulators or professional advisers where legally required4. Retention
We keep records in line with our retention schedule, including: payroll, timesheet and invoice records for 6 years (HMRC); right-to-work evidence for 2 years after the engagement ends (Home Office); DBS information only as long as necessary under the DBS code of practice; general staff records for 6 years after engagement ends (limitation of legal claims). The current schedule is available from the administrator.
5. Your rights
You have the right to: access your data; have inaccurate data corrected; request erasure; restrict or object to processing; and data portability where applicable. To exercise any right, contact the administrator (details below). We will respond within one calendar month. Some records must be retained for the legal periods above even if you request erasure.
6. Security
Access to this portal requires an individual login. Documents are only accessible to you and authorised administrators; access to DBS, identity and health documents is restricted and logged. Data is transferred over HTTPS. Audit logs record who viewed, uploaded, changed or deleted records.
7. Contact and complaints
Data queries: contact Koloth Care Solutions Ltd administration at admin@koloth.com.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
(test edit)
(test edit)
(test edit)